A Wake-Up Call: Data Breach Standing Is Getting Easier

By Travis LeBlanc and Jon Knight

In 2017, consumers in data breach lawsuits were vastly more successful at persuading federal appellate courts that they had pled a constitutional injury. This is a dramatic reversal in the trajectory of federal jurisprudence on “standing” in data breach cases. The Supreme Court had previously held in Clapper v. Amnesty International USA that “conjectural” or “hypothetical” injuries were not sufficient to establish standing and that any alleged harm must be “certainly impending.” In the vast majority of data breach class actions, however, consumer plaintiffs have not suffered any actual or imminent harm that they can reasonably connect to a particular breach. These plaintiffs have traditionally faced an almost Sisyphean task to establish standing in the absence of any financial or tangible harm. Indeed, following the Supreme Court’s 2016 holding in Spokeo, Inc. v. Robins that a plaintiff must allege an “injury-infact” that is “concrete” and “particularized,” many commentators and defense counsel expected that plaintiffs would find it even more challenging to establish Article III standing. But, that has turned out not to be the case.  More